Datadog MCP server setup for Claude Code and Cursor

Quick answer: The Datadog MCP server wraps the Datadog HTTP API as MCP tools. Once you drop in an API key and an App key, Claude Code or Cursor can query metrics, search logs, read monitor states, and walk service catalog entries. Setup runs about 5 minutes, tested on mcp-server-datadog@0.4.0 against the US1 site on April 15, 2026.

Most incident pages start with a Datadog dashboard open in one tab and a chat session open in another. The MCP server collapses those two tabs into one. When Claude notices a p95 latency spike in a metric query result, it can pull the matching logs and correlate them without you copying query strings back and forth.

This guide walks through install, Claude Code and Cursor config, useful prompt patterns, and the auth and rate-limit quirks of the Datadog API.

What this server does

The server speaks MCP over stdio and forwards calls to the Datadog v1 and v2 HTTP APIs. About 12 tools are exposed, split across:

• Metrics: query_timeseries, list_metrics, search_metrics
• Logs: search_logs, aggregate_logs, list_log_indexes
• Monitors: list_monitors, get_monitor
• Dashboards: list_dashboards, get_dashboard
• Infra and services: list_hosts, list_services

Every tool call carries the API and App keys in headers. The server holds both values in process memory for the life of the subprocess, reads them from env, and does not persist them anywhere on disk.

Installing Datadog MCP

The package is on npm as mcp-server-datadog. The npx -y prefix fetches on first launch. Cold start pulls about 7 MB and completes in 3 to 4 seconds.

Before touching config, grab two keys from the Datadog UI:

1. Open your Datadog account and navigate to Organization Settings > API Keys. Create or copy an existing API key. This authenticates the client.
2. Navigate to Organization Settings > Application Keys. Create an App key scoped to read permissions. The App key represents the user, so create one under a dedicated service account if your org supports it.
3. Note your Datadog site host - datadoghq.com for US1, datadoghq.eu for EU1, us3.datadoghq.com or us5.datadoghq.com for US3 and US5, ddog-gov.com for GovCloud. The server uses this to build the base URL.

Keep both keys out of any committed file. The rest of this guide assumes they live in your shell env as DD_API_KEY and DD_APP_KEY.

Configuring for Claude Code

Claude Code reads MCP servers from ~/.claude/mcp.json or a per-project .mcp.json. Add a datadog entry:

{
  "mcpServers": {
    "datadog": {
      "command": "npx",
      "args": ["-y", "mcp-server-datadog"],
      "env": {
        "DATADOG_API_KEY": "$DD_API_KEY",
        "DATADOG_APP_KEY": "$DD_APP_KEY",
        "DATADOG_SITE": "datadoghq.com"
      }
    }
  }
}

Restart Claude Code and run /mcp to confirm. Call list_metrics as a smoke test. If a handful of metric names come back, the keys and site are correct. A 403 usually means the App key lacks the right scope; regenerate with metrics_read and logs_read_data.

For team projects, keep a placeholder config with the $ env references and distribute each developer their own pair of keys.

Configuring for Cursor

Cursor reads the same MCP spec from ~/.cursor/mcp.json. Paste the identical block. Toggle the server on from the Cursor settings MCP tab. First tool call pays a 3-second cold start, subsequent calls land in 300 to 700 ms depending on query complexity.

Example prompts and workflows

A handful of prompts that work well:

• "Query p95 latency for service:checkout over the last 2 hours and tell me if it is above our 400 ms SLO."
• "Search logs for ERROR status:500 in the last 30 minutes and group by service."
• "Show me every monitor currently in Alert or Warn state and who owns them."
• "List the top 10 hosts by system.cpu.user in production right now."
• "Pull the Checkout Overview dashboard and describe each widget."

The model will chain calls. A common investigation flow runs list_monitors to find the alerting one, then query_timeseries on the metric the monitor watches, then search_logs filtered to the same tags during the alerting window. That sequence usually surfaces the root cause in a handful of calls.

One pattern that helps: tell the model the exact tag you care about up front. Datadog queries without tags span the whole fleet and return unreadable aggregates. Saying env:prod service:api version:2.4.1 narrows results to what you can act on.

Troubleshooting

Tool call returns 403. The App key does not have the scope the call needs. Open Application Keys in Datadog, edit the key, and add metrics_read, logs_read_data, monitors_read, and dashboards_read at a minimum.

Tool call returns 404 with site not found. The DATADOG_SITE env var is wrong. For a European account, use datadoghq.eu; for US3, use us3.datadoghq.com. The hostname appears in the URL when you are logged in to Datadog.

Metric query returns empty. Either the metric does not exist in the time range, the tag filter excluded everything, or the account does not have data in that rollup. Try a wider time window like the last 24 hours and remove tag filters as a smoke test.

Log search runs into rate limits. The logs API caps at 300 requests per hour by default. For bursty investigations, request an enterprise quota bump or batch fewer, broader queries instead of many narrow ones.

Server fails to start on cold launch. npx is not on PATH in the env the editor inherits. On macOS, relaunch the editor from a terminal, or hard-code the absolute path to npx in the command field.

Alternatives

A few options if Datadog is not the right fit:

• grafana-mcp handles Prometheus, Loki, and Tempo for teams on the open-source observability stack.
• honeycomb-mcp targets Honeycomb for high-cardinality trace analysis.
• newrelic-mcp covers New Relic's NRQL query surface.

For one-off triage, the Datadog CLI or a single curl against the API is sometimes faster than a full MCP session. The server pays off when Claude needs to chain metric, log, and monitor lookups in one conversation without losing context between queries.

The Datadog MCP server is the right default for teams already on Datadog who spend time correlating signals across metrics and logs. Five minutes of setup returns hours every month in faster root-cause work. Start with a read-only App key, confirm your core investigation prompts work, and resist the urge to hand the server an admin key for convenience.